AO 106 (Rev. 04/10) Application for a Search Warrant 


United States District Court 

for the 

Western District of Missouri 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

Information associated with Discord User IDs, that is 
stored at premises controlled by Discord, more fully 
described in Attachment A 


Case No. 17-SW-00114-JTM 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 

^'irflorWStKfrf asso e 6iafecFwitH^dliscofc/'User IDs that is stored at the premises controlled by Discord, headquartered in 
Campbell, California, more fully described in Attachment A. 


located in the 


Northern 


District of 


California 


, there is now concealed (identify the 


person or describe the property to be seized): 

See Attachment B (Items to be seized), attached hereto and incorporated by reference, which is contraband, 
instrumentalities, and evidence concerning enticement of a minor, travel with intent to engage in illicit sexual conduct, 
production, reciept and possession of child pornography in violation of 18 U.S.C. §§ 2422(b), 2423(b), 2251(a), & 2252. 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
pf evidence of a crime; 

pf contraband, fruits of crime, or other items illegally possessed; 

& property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Code Section 

18 U.S.C. § 2422(b) 

18 U.S.C. § 2423(b) 

18 U.S.C. §2251 (a) & 2252 


Offense Description 

Enticement of a Minor 

Travel with Intent to Engage in Illicit Sexual Conduct 
Production, Receipt and Possession of Child Pornography 


See atlHRe^ffiSivipRf^uppo^of Search Warrant and Attachment A (Place to be Searched) and Attachment B 
(Items to be Seized). 




Continued on the attached sheet. 


□ Delayed notice of 


days (give exact ending date if more than 30 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attache* 



) is requested 


Applicant’s signature 

Amy L. Ramsey, Special Agent (FBI) 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: 


05/04/2017 


City and state: Kansas City, MO 



Printed name and title 
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17-SW-00114-JTM 


AFFIDAVIT 

I, Agent Amy L. Ramsey, the undersigned, being duly sworn, state the following is true 
and correct to the best of my knowledge and belief. 

1. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have 
been so employed since November 2008. Prior to this I was an Investigative Specialist for the 
FBI’s Special Surveillance Group in Boston, Massachusetts. My responsibilities involve, 
amongst other investigative responsibilities, investigating violations of federal law, including 
Title 18, United States Code (USC), Sections 2422(b); 2423(b), 2251(a), and 2252(a)(2) and (4). 
The following is based on my own investigation and reports made to me by other law 
enforcement officers. 

2. I make this affidavit in support of an application for a search warrant for 
information associated with certain Discord accounts that are stored at premises owned, 
maintained, controlled, or operated by Discord, a social networking company headquartered at 
1901 SO Bascom Avenue, Suite 1180, Campbell, California, 95008. This affidavit is made in 
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A) to require Discord to disclose to the Government records and other information in 
its possession, pertaining to the subscribers or customers operating the accounts. The 
information to be disclosed by Discord is described in Attachment A, which will be searched by 
law enforcement for the information described in Attachment B. The Government believes all 
information obtained will be evidence, fruits or instrumentalities of Title 18 U.S.C. § 2422(b), 
enticement of a minor, Title 18 U.S.C. § 2423(b), travel with intent to engage in illicit sexual 
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conduct, Title 18 U.S.C. § 2251(a), production of child pornography, and Title 18 U.S.C. 


§ 2252(a)(2) and (4), receipt and possession of child pornography. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

PROBABLE CAUSE 

4. On April 9, 2017, at approximately 1:00 a.m., 12-year-old Jane Doe, date of birth 
02/XX/2005, was discovered missing by her parents from the family residence in Blue Springs, 
Missouri. Jane Doe’s parents initially reported Jane Doe as a runaway to the Blue Springs Police 
Department (BSPD), and subsequently found that she was missing and possibly endangered after 
accessing her on-line accounts. BSPD responded to Jane Doe’s residence. Jane Doe’s parents 
were able to access Jane Doe’s online Facebook account and an application called “Discord.” 1 
Jane Doe’s parents found Jane Doe utilized the Discord screen name/user name “William’s 
Queen” and was in communication with an individual utilizing the Discord screen name/user 
name ‘ King William.” BSPD requested the Missouri Information Analytic Center (MIAC) and 
the National Center for Missing and Exploited Children (NCMEC) perform database searches for 
the Discord screen names/usemames as well as Facebook Vanity Name “Willy Cruz” in an 
attempt to identify King William and/or Willy Cruz. The Discord usemame/screen name King 
William was identified as 22- year-old William Lee Dela Cruz (“Dela Cruz”), with a residence 
in Oxon Hill, Maryland. 


'Discord is described by the Google Play Store as free cross-platform voice and text chat 
designed specifically for on-line game users. 
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5. Jane Doe’s parents provided consent for law enforcement to access Jane Doe’s 
social media accounts. Investigators reviewed Jane Doe’s Facebook Account (Facebook Vanity 
Name “Baka Chan”) in which she communicated with “Willy Cruz,” Discord chats, and Jane 
Doe’s Skype account. A review of Jane Doe’s Discord account revealed in addition to 
communications with King William she had a separate contact in her account for a “King 
Willy.” Based on the review of Jane Doe’s Facebook account, Discord chats, and information 
also found in Jane Doe’s Skype account, Jane Doe and Dela Cruz exchanged messages between 
November 2016 and April 2017. Some of the messages were explicitly sexual in nature and 
included discussions about masturbation and sexual activity with each other. Jane Doe and Dela 
Cruz exchanged identifying photographs of each other and discussed Jane Doe’s age. 

6. During a Discord chat, Jane Doe advised King William (Dela Cruz) she was 15 
years of age and was in the seventh grade. On 2/XX/2017, Jane Doe’s birthday, Dela Cruz asked 
Jane Doe “[h]ow old are you now?” Jane Doe responded “15.” Dela Cruz then stated “[w]e 
have 3 more years” and further stated “Iloveyousomuch.” 

7. Based on the information obtained from MIAC and NCMEC, Dela Cruz’s aunt, 
Norleen Sullivan, residence address 574 Wilson Bridge Drive, Apt B2, Oxon Hill, Maryland, 
was identified. BSPD contacted the Prince George’s County Police Department (PGPD), and 
Detective Limpton made contact with Sullivan at her residence. Sullivan provided Detective 
Limpton with the license plate number to her vehicle, Maryland license plate number 6CK5071, 
and described the car as a Nissan Versa. Sullivan told Detective Limpton that her sons, William 
and Jason Dela Cruz, were in possession of the vehicle. An Amber Alert was subsequently 
issued by the Missouri Highway Patrol (MHP), which lead to the recovery of Jane Doe on 
April 9, 2017, by the Wentzville Missouri Police Department. 
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8 . 


After Jane Doe was recovered, she was interviewed at the Wentzville Missouri 


Police Department. During the interview Jane Doe confirmed she and Dela Cruz were in an on¬ 
line relationship. Jane Doe stated she met Dela Cruz online through the PC based role-play 
computer game “ONIGIRI” in early 2016. Jane Doe stated she and Dela Cruz stopped talking 
for a period of time before reconnecting in November 2016 when they began to use Skype, 
Discord, and Facebook Messenger to communicate. 

9. On April 9, 2017, Dela Cruz was arrested by law enforcement in Wentzville, 
Missouri. Dela Cruz was read his Miranda rights at the Wentzville Missouri Police Department, 
and voluntarily agreed to speak with investigators. Dela Cruz stated he met Jane Doe online 
through a PC based role-playing computer game known as “ONIGIRI.” Dela Cruz stated he 
currently resides with his brother and Sullivan at 574 Wilson Bridge Drive, Apt B2, Oxon Hill, 
Maryland. Dela Cruz utilized a computer in his bedroom to communicate with Jane Doe. Dela 
Cruz characterized his relationship with Jane Doe as boyfriend and girlfriend. He stated Jane 
Doe had provided him with several different names and ages, but he believed her to be between 
the ages of sixteen and seventeen. He stated he knew she attended middle school. Dela Cruz 
received several pictures of Jane Doe and he commented that she seemed to be small. He 
admitted to having additional contact with Jane Doe using Facebook, Skype, and a landline 
telephone from his home in Maryland. 

10. Dela Cruz further stated that on or about April 6, 2017, he received a message 
from Jane Doe in which she told him she ran away from home. She also told him her parents 
prohibited her from using Facebook. Dela Cruz and his brother, Jason Dela Cruz, drove to 
Missouri from Maryland to pick Jane Doe up. Dela Cruz stated they drove to Missouri with the 
intent of driving Jane Doe back to Maryland. Upon arriving in Blue Springs, Missouri, Dela 
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Cruz communicated with Jane Doe on Discord with his iPhone by WiFi connection, as the phone 
was not activated. Dela Cruz then went to Jane Doe’s house and picked her up. 

11. After picking Jane Doe up, Dela Cruz stated they stopped at a rest stop along 1-70 
in Missouri, where he and Jane Doe engaged in sexual contact. Dela Cruz and Jane Doe returned 
to the vehicle and continued to travel eastbound on 1-70 towards Maryland. During the drive, the 
brothers had an argument. As a result, Jason Dela Cruz dropped Jane Doe and Dela Cruz off at a 
service station and drove away. Dela Cruz and Jane Doe attempted to obtain a room at the 
Hampton Inn in Wentzville, Missouri but did not have sufficient funds for a room. Dela Cruz 
and Jane Doe slept on a couch in the lobby of the hotel. 

12. Dela Cruz stated that during or shortly after their stay at the hotel, he realized he 
had received a Facebook friend request from Jane Doe’s mother. Dela Cruz accepted the request 
and then observed a post where Jane Doe’s mother identified her daughter as missing and stated 
Jane Doe was 12 years old. Dela Cruz stated that despite the information provided by Jane 
Doe’s mother, Dela Cruz and Jane Doe went to a secluded location in a wooded area near the U 
Gas service station in Wentzville, Missouri, and engaged in sexual activity for the second time. 
Dela Cruz indicated he knew what he did was wrong. He also stated he lied to his brother, Jason 
Dela Cruz, by telling him that Jane Doe was nineteen years old to conceal the fact she was under 
aged. 

13. Following the interview with Dela Cruz, investigators located the wooded area 
near the U Gas service station in Wentzville, Missouri described by Dela Cruz. Investigators 
observed a blanket spread on the ground with numerous articles of clothing and children’s toys 
such as a My Little Pony sitting on the blanket. A pair of men’s underwear was located on top of 
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the blanket. A pair of girl’s/women’s panties was located near the blanket under a bag. A pink 
backpack was located on the blanket which displayed Jane Doe’s first name. 

14. Jason Dela Cruz turned himself into authorities in a suburb of Columbus, Ohio. 
Jason Dela Cruz cooperated with law enforcement, was interviewed, and confirmed the above 
information regarding the travel and purpose of travel from Maryland to Missouri with his 
brother. Jason Dela Cruz knew that Dela Cruz had been “cyber” dating Jane Doe for about a 
year. 

15. On April 10, 2017, Dela Cruz was charged by complaint in the Western District 
of Missouri with one count of enticement of a minor pursuant to 18 U.S.C. § 2422(b) in case 
number 17-MJ-00065-SWH. An indictment was returned by the Grand Jury on April 19, 2017, 
charging Dela Cruz with one count of enticement of a minor in violation of 18 U.S.C. § 2422(b), 
and one count of travel with intent to engage in illicit sexual conduct in violation of 18 U.S.C. 

§ 2423(b). (See 17-00129-01-CR-W-DGK.) 

16. At the time of Dela Cruz’s arrest, he had in his possession a white and gold 
colored iPhone. The iPhone was seized by law enforcement and a federal search warrant was 
obtained for the contents of the phone on April 17, 2017, from United States Magistrate Judge 
Robert E. Larsen. The search warrant was executed on April 18, 2017, and revealed that while 
communicating with Jane Doe via Skype on March 30, 2017, Dela Cruz took/recorded a series of 
approximately 22 screen shots of Jane Doe. In these screen shots Dela Cruz’s face is depicted in 
the photo inset on the bottom right comer of the images, and the Skype logo is depicted in the 
right upper corner of the larger images of Jane Doe. 

17. The series of approximately 22 Skype screen shots located on Dela Cruz’s iPhone 
include clothed images of Jane Doe, in addition to child pornography images depicting the 
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lascivious exhibition of Jane Doe’s genitalia. The screen shot images depict Jane Doe on a bed 
with a My Little Pony 2 poster or picture on the wall above the bed. An example of one of the 
screen shot images depicts Jane Doe on the bed, nude from the waist down, on her hands and 
knees facing away from the camera so that her genitalia is exposed to the camera. The My Little 
Pony blanket is depicted in the image behind Jane Doe. In my opinion this image meets the 
definition of sexually explicit conduct as set forth in 18 U.S.C. § 2256. 

TECHNICAL BACKGROUND RELATING TO DISCORD 

18. Discord owns and operates a free-access all in one voice and text chat application 
website of the same name that can be accessed at http://www.discordapp.com. Discord allows 
its users to establish accounts with Discord, and users can then use their accounts to 
communicate with other Discord users. When signing up for a Discord account, the user must 
agree to Discord’s Terms of Service. 3 Discord’s terms of service, Rules of Conduct and Usage 
state, “You agree not to use the Service in order to: violate any applicable laws or regulations, or 
promote or encourage any illegal activity. 

19. Discord asks users to provide basic contact information to Discord, either during 
the registration process or thereafter. The information may include the user’s full name, birth 
date, contact e-mail addresses, physical address (including city, state, and zip code) telephone 
numbers, screen names, websites, and other personal identifiers. Discord also assigns a user 
identification number to each account. 


2 0n April 27, 2017,1 contacted Jane Doe’s mother and confirmed that displayed on the 
wall in Jane Doe’s bedroom, above Jane Doe’s bed, is a My Little Pony blanket. 

’Discord’s Terms of Service may be accessed online: https://discordapp.com/tos 
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20. Discord users can exchange private messages on Discord with other users as well 
as participate in chat room discussions, and voice chat. 

21. Discord may also retain Internet Protocol (“IP”) logs for a given user ID or IP 
address. These logs may contain information about the actions taken by the user ID or IP 
address on Discord, including information about the type of action, the date and time of the 
action, and the user ID and IP address associated with the action. For example, if a user views a 
Discord profile, that user’s IP log would reflect the fact the user viewed the profile, and would 
show when and from what IP address the user did so. 

22. Social networking providers like Discord typically retain additional information 
about their users’ accounts, such as information about the length of service (including start date), 
the types of service utilized, and the means and source of any payments associated with the 
service (including any credit card or bank account number). In some cases, Discord users may 
communicate directly with Discord about issues relating to their account, such as technical 
problems, billing inquiries, or complaints from other users. Social networking providers like 
Discord typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. 

23. The computers or servers of Discord are likely to contain all the material just 
described, including stored electronic communications and information concerning subscribers 
and their use of Discord, such as account access information, transaction information, and 
account activation. 

24. Generally, when served with a search warrant for electronic communications, the 
electronic communications service provider (ECSP), such as Discord, will send the contents of 
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the specified account(s) to the investigating agency, usually on a CD or DVD, for the 
investigator to review. The ECSP can copy the contents of the entire account because that is 
within their expertise. Though the ECSP affirms that the records relate to the specified email 
account, the provider does not and will not undertake the examination of the contents of an 
account to make a determination as to what is relevant or irrelevant to the investigation. 
Generally, and in this case particularly, the provider is not familiar with the investigation and is 
not in a position to identify the victim(s) or subject(s) of the investigation. 

25. The provider is neither qualified nor trained to search the account information as 
would a law enforcement officer. Only a trained agent, familiar with the statutory violations and 
facts of the case, can determine what items should or should not be seized. For these reasons, 
your Affiant requests the provider disclose the records listed in Section 1 of Attachment B, for 
the account(s) listed in Attachment A. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

26. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. 2703(a), 2703(b)(1)(A) and 2703(C)(1)(A), using the warrant to 
require Facebook to disclose to the Government copies of the records and other information 
(including the content of communications) particularly described in Section I of Attachment B. 
Upon receipt of the information described in Section I of Attachment B Government-authorized 
persons will review the information to locate the items described in Section II of Attachment B. 

CONCLUSION 

27. Based on my training and experience, and the facts as set forth in this affidavit, 
there is probable cause to believe on the computer systems in the control of Discord there exists 
evidence of crimes: child enticement, 18 U.S.C.§ 2422(b); travel with intent to engage in illicit 
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sexual conduct, 18 U.S.C. §2423(b); production of child pornography, 18 U.S.C. § 2251(a); and 
receipt and possession of child pornography, 18 U.S.C. § 2252(a)(2) and (4). Accordingly, a 
search warrant is requested. 

28. This Court has jurisdiction to issue the request warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C 2711, 18 U.S.C. 2703(a), 2703(b)(1)(A) and 
2703(C)(1)(A). Specifically, the court is a district court of the United States that has jurisdiction 
over the offense being investigated. 

29. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer not 
required for the service or execution of this warrant. 

30. Based on the foregoing, I request that the court issue the proposed search warrant. 
Because the warrant will be served on Discord who will then compile the requested records at a 
time convenient to it, reasonable cause exists to permit the execution of the requested warrant at 
any time in the day or night. 
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31. I further request that the court order that all papers in support of this application, 
including the affidavit, search warrant, and search warrant return, be sealed until further order of 
the court. These documents could potentially identify the minor victim in the case, in violation 
of 18 U.S.C. § 3509(d). Accordingly, there is good cause to seal these documents because the 
confidentiality of information concerning minor victims is a right afforded to victims of crime 
through 18 U.S.C. § 3509. However, I seek authority to release the documents as discovery in 
related criminal cases without the need for these pleadings to be unsealed. 


Respectfully Submitted, 


Amy L. rvaniat}' 

Special Agent 

Federal Bureau of Investigation 



Sworn and subscribed before me 
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17-SW-00114-JTM 

ATTACHMENT A 
Property to be Searched 

This warrant applies to information associated with the Discord users: 

William’s Queen#5042 
King William #3067 
King Willy #3362 

that is stored at premises owned, maintained, controlled, or operated by Discord, a company 
headquartered at 1901 SO Bascom Avenue, Suite 1180, Campbell, California, 95008. 
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17-SW-00114-JTM 


ATTACHMENT B 
Particular Things to be Seized 

I. Information to be disclosed by Discord 

To the extent the information described in Attachment A is within the possession, 
custody, or control of Discord, Discord is required to disclose the following information to 
the Government for each user ID listed in Attachment A: 

(a) All contact information, including full name, user identification number, birth 
date, contact e-mail addresses, physical address (including city, state, and zip 
code), telephone numbers, screen names, websites, and other personal 
identifiers; 

(b) All Photoprints, including all photos uploaded by that user ID and all photos 
uploaded by any user that have that user tagged in them and any exif/metadata 
information associated with the photos; 

(c) All other communications and messages made or received by the users, 
including all private messages and pending requests; 

(d) All IP logs, including all records of the IP addresses that logged into the 
account and intra-session IPs; 

(e) The length of service (including start date), the types of service utilized by the 
user, and the means and source of any payments associated with the service 
(including any credit card or bank account number); 

(f) All privacy settings and other account settings; and 
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(g) All records pertaining to communications between Discord and any person 
regarding the user or the user’s Discord account, including contacts with 
support services and records of actions taken. 

II. Information to be seized by the Government 

All information, described above in Section I, that constitutes fruits evidence and 
instrumentalities of violations of 18 U.S.C. § 2422(b), enticement of a minor, 18 U.S.C. 

§ 2423(b) travel with intent to engage in illicit sexual conduct, 18 U.S.C. § 2251(a) the 
production of child pornography, and 18 U.S.C. § 2252(a)(2) and (4), receipt and possession 
of child pornography since January 2016, including information pertaining to the following 
matters: 

(a) Communications between the users identified in Attachment A; 

(b) Records relating to who created, used or operated the accounts identified in 
Attachment A; 

(c) Records relating to enticement of minors or an interest in the enticement of 
minors; 

(d) Records relating to travel with intent to engage in illicit sexual conduct; 

(e) Records relating to the production, receipt, or possession of visual depictions 
of minors engaged in sexually explicit conduct as defined in 18 U.S.C. 

§ 2256(2); and 

(f) Records relating to a sexual interest in minors. 
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